PayPal quietly opted users into sharing data with third parties for “personalized shopping experiences,” according to multiple complaints on social media and 404 Media’s own tests.
“Starting early summer 2025, we’ll be building more personal experiences for you,” PayPal says on its “Personalized shopping” settings page. “You can opt in and out of sharing at any time by adjusting this setting.”
On Monday, before I contacted PayPal for comment, the page also included a line that said "We'll use info collected about you after November 27, 2024 to personalize your shopping." As of Tuesday, that line is no longer on the page.
As noted by Twitter user Ellen Datlow, you can find that setting and change it by logging into your PayPal account and going to Settings > Data & Privacy > Manage shared info > Personalized shopping. Or, click here while logged in.
PayPal is updating their ToS to let themselves give your data to merchants starting Nov & they're banking on people not knowing to opt out, SO to opt out before they start: go to Settings >Data & Privacy > Manage shared info >Personalized shopping, & toggle that shit off
— Ellen Datlow (@EllenDatlow) September 29, 2024
A link on that page, “how personalized shopping works,” opens a popup with a very short description: “We’ll share recommendations with participating stores based on your shopping history and preferences. Your info helps participating stores show you products [sic] offers and rewards you might like.”
As of writing, PayPal opts users into sharing their data by default, without their knowledge—unless they navigate to the personalized shopping settings on their own. On that page, a toggle is set to “sharing on,” agreeing to the statement “Let us share products, offers, and rewards you might like with participating stores.” 404 Media tested the process with two PayPal accounts, including a historical one and one created over the last few days. In both cases, the accounts were opted in by default.
There’s also a link to a new version of PayPal’s privacy statement, which differs from—and has a different URL than—the privacy statement you would navigate to from anywhere else on the site. The new statement's URL ends with "preview-privacy-full-effective-november272024."
The new statement adds several sections relevant to the personalized shopping feature, including:
Personal Information we disclose includes, for example, products, sizes, preferences, and styles we think you’ll like. Unless we are required by law to obtain your consent, we disclose Personal Information collected after November 27, 2024 (or from earlier if you consent) for personalized shopping experiences. To opt-out of disclosures or Personal Information to Partners and Merchants for personalized shopping experiences, log into your PayPal account and edit your preferences in the Data and Privacy setting. If you opt-out, we will continue to disclose your Personal Information as necessary to complete transactions you initiate, but will not disclose Personal Information to Partners and Merchant for personalized shopping experiences.
The new privacy statement also says personal information sent to partners and merchants or their service providers are “subject to the Partners' and Merchants' own privacy policies and procedures,” and that PayPal is “not responsible for the privacy or security practices of Partners and Merchants.”
The new statement also says that if you opt out of this data sharing, PayPal will continue disclosing personal information “as necessary to complete transactions you initiate” but won’t send personal information to partners and merchants “for personalized shopping experiences.”
I asked PayPal whether customers will be directly notified before November 27 that the company plans to share their data with third party partners and merchants, and what happens to users’ data if they opt out after that date. Paypal did not respond.
Several platforms have been caught changing their terms of service without explicitly notifying customers recently, including education platform Udemy, which announced that it would train generative AI on teachers’ classes and automatically opted them in to that data sharing, and LinkedIn also started training AI on user data before updating its terms of service. Optery, a data deletion service that updated its terms of service to say the company may transfer user data to OpenAI and turned on the data transfer for users by default—and then walked back those terms after public backlash.
